The privacypass-py package on PyPI masquerades as a Privacy Pass client library but contains no cryptographic functionality. Instead, it performs data exfiltration by collecting sensitive environment variables, system information, and process details, then sending this data to a hardcoded external IP address over unencrypted HTTP. This malicious behavior occurs both during package installation and on module import, bypassing typical build isolation protections.
The npm package @goparrot-dashboard/app version 0.0.2 contains malicious code that executes automatically during installation. It collects host identifiers such as hostname, current user, and working directory, then sends this information to an attacker-controlled callback server via DNS and HTTPS requests. This data exfiltration occurs without user interaction, effectively leaking identifying information about the installer's machine.
The npm package axelarjs-sdk@1.0.1 is a malicious package that contains no functional code but executes a preinstall script during installation. This script sends the machine's hostname, OS username, and local time to a Discord webhook, potentially leaking sensitive environment information to an attacker-controlled endpoint.
The npm package 'sol-wallet-adapter' versions 1.0.0, 1.0.1, and 1.0.7 are malicious. These versions contain no functional code but execute a preinstall script that sends the machine's hostname, OS username, and local time to a Discord webhook, potentially leaking sensitive environment information. The package was published by suspicious accounts and communicates with a domain linked to malicious activity.
The npm package cutekitten-test@1.0.1 contains malicious code that executes during installation. Its preinstall script sends the machine's hostname, OS username, and local time to a Discord webhook, potentially leaking sensitive environment information. The package has no functional code beyond this data exfiltration behavior.
The npm package calculator-preinstall-hook-demo version 1.1.2 contains malicious code that executes a preinstall script during installation. This script sends the machine's hostname and OS username to a Discord webhook, potentially leaking sensitive environment information. The package was published by the npm account bigdevin55 and is pulled in as a dependency by calculator-preinstall-chain-demo@1.1.2.
The npm package calculator-preinstall-chain-demo versions 1.1.1 and 1.1.2 is identified as malicious. It does not have its own install script but depends on calculator-preinstall-hook-demo@1.1.2, which runs a preinstall script that sends the machine's hostname and OS username to a Discord webhook. This behavior is considered malicious due to unauthorized data exfiltration.
The pystr-codec package on PyPI contains malicious code that executes on every Python startup. It runs obfuscated JavaScript via a Bun engine to exfiltrate credentials to a public GitHub repository, establish persistence, accept remote commands, spread using stolen credentials, and perform destructive actions if credentials become invalid. This malware is linked to the Miasma-family worm.
VAPOR PANDA initiated a global espionage campaign starting October 17, 2026, leveraging the AI-driven ARTEX framework along with DeepSeek and commercial large language models to conduct simultaneous intrusions against over 200 organizations worldwide. Targets included foreign ministries in Latin America, Europe, Asia, and the Middle East, as well as U.S. semiconductor, defense, pharmaceutical, nuclear, and telecommunications sectors. The adversary deployed the BLOODALCHEMY backdoor, performed credential spraying, and directed AI agents to identify systems lacking endpoint security sensors. This campaign marks a shift from single intrusions to multiple autonomous attack paths coordinated by AI agents under human strategic guidance in Chinese. It highlights the use of open-source AI combined with commercial LLMs to scale intrusion operations beyond manual capabilities.
The npm package claims-ac1 version 1.0.0 is a malicious package that collects system information during installation without user consent. It uses dependencies fetched from GitHub tarballs that execute a preinstall script to send details such as Node.js version, home directory, working directory, platform, and architecture to a remote collector host. The package has no legitimate functionality and allows the attacker to change the collector host and code at any time without a new npm release. Machines with this package installed should be considered fully compromised.
The npm package @mamans2973/maman versions 1.0.0 through 1.0.3 contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the system, necessitating immediate rotation of all secrets and keys from a different, uncompromised machine. Removal of the package alone may not eliminate all malicious software introduced by it.
VOLTA is a sophisticated Windows infostealer malware that uses AI-powered victim profiling to prioritize targets based on their monetization potential. It harvests credentials, browser data, cryptocurrency wallets, sessions from various platforms, and personal information. The stolen data is compiled into a structured evidence bundle and analyzed by large language models (LLMs) such as Claude Opus via OpenRouter, which rank stolen assets by value and assess victim security posture. VOLTA also performs live enrichment by accessing victim accounts on Gmail, Uber Eats, DoorDash, Discord, and Roblox using stolen tokens. The malware self-deletes after execution and operates through third-party infrastructure without actor-owned servers, indicating a builder-based distribution model allowing customized deployments.
The doctreelstm package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The ms-client-portal npm package is a malicious dependency-confusion package containing no functional code but executing scripts that send sensitive environment information to an external server during installation. It was published with versions 1.0.0 and 10.0.0 on 2026-10-31. Installation of this package results in exposure of user name, hostname, and working directory to a remote attacker. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately from a different machine.
The multi-convert package on PyPI contains malicious code in specific versions of its dependency 'is-it-ai'. Version 0.1.4 of the dependency includes a trigger that fingerprints the environment and contacts a remote server to download and execute a remote executable. Other versions serve as cover to hide the malicious activity. This campaign is identified as having clear malicious intent, including downloading and executing remote code.
The md-to-slides package on PyPI contains malicious code hidden in a specific dependency (is-it-ai) in version 0.1.1. This malicious code fingerprints the environment and contacts a remote server to download and execute a remote executable if instructed. Other versions appear to be decoys to conceal the malicious version. This campaign is clearly malicious and targets users by embedding harmful actions within a library dependency.
The skills-analyzer package on PyPI contains malicious code in its dependency is-it-ai version 0.1.1. This malicious code fingerprints the environment and contacts a remote server, which may respond with a URL to download and execute further malicious payloads. Other versions of the package exist to obscure the presence of the malicious version. The campaign is identified as a targeted attack with clear malicious intent, including downloading and executing remote executables.
The is-it-ai package on PyPI contains malicious code in specific versions (0.1.0, 0.1.1, 0.1.3) that, when triggered, fingerprints the environment and contacts a remote server. If the server responds with a URL, the package downloads and executes a remote executable. This behavior is part of a targeted attack campaign involving intentional inclusion of malicious code in a dependency, designed to hide malicious actions behind legitimate package versions.
VOLTA-AUTODOXER is a self-deleting Windows infostealer that uses AI to prioritize stolen victim data by monetization value. After harvesting credentials, sessions, wallets, and other sensitive data, it builds a detailed evidence bundle about the victim, enriched via stolen session access. This bundle is sent to an LLM via OpenRouter, which acts as an intelligence analyst to rank the victim's assets and assess their security posture. The malware uses a multi-model fallback approach to ensure the AI completes the assessment despite model refusals. VOLTA operates as a builder model, allowing customers to compile customized binaries with their own API keys. There is no attacker-owned infrastructure, and exfiltration occurs in multiple stages. The AI integration represents a novel approach in malware by automating victim profiling and prioritization.
Attackers impersonated IT help desk personnel on Microsoft Teams to gain unauthorized access to Active Directory environments by social engineering users into sharing Quick Assist remote support session codes. They exploited misconfigured Active Directory Certificate Services using ESC1 and ESC8 attack paths, obtained certificates for privileged accounts, performed DCSync operations to harvest credentials, and exfiltrated data via Rclone to external SFTP servers. Another intrusion used PetitPotam to coerce domain controller authentication and relay NTLM credentials to obtain unauthorized certificates. These attacks did not exploit vulnerabilities in Microsoft Teams itself but relied on impersonation and legitimate remote access tools combined with Active Directory misconfigurations.
